Dixons Carphone: Yeah, so, about that hack we said hit 1.2m records? Multiply that by 8.3 Dixons Carphone today admitted that the data breach it discovered last month affected nine times as many people as first believed. The retailer 'fessed up to the hack in June this year, saying that it had involved 5.9 million payment cards and 1.2 million personal data records. However, in a statement issued today (PDF), …
"We're disappointed in having fallen short here, and very sorry for any distress we've caused our customers. I want to assure them that we remain fully committed to making their personal data safe with us."
You failed.
I'm getting very tired of these mass data breaches without any real consequence to the companies involved. I know that people should probably be not giving them this info, but I wonder how much is by choice - after all, if you buy something, you need to give your details, and I'm pretty sure you don't get an option to opt-in to the site keeping them.
It's high time CEO's were held directly responsible for these issues.
It's high time CEO's were held directly responsible for these issues.
Baldock is a former banker, so I wouldn't cry if he were drowned in sewage, but since he only joined Dixons Carphone in January of this year, we'd be disposing of him for fun, rather than punishing those accountable for the Dixons Carphone data breach in question.
They will find some poor technician and blame it all on that person and then they'll say they found the culprit so holding them responsible is unfair, where's my additional bonus for finding the culprit etc. etc. etc.
Even worse.... No consequences for senior staff or executives and their bonuses. This is no different from robo callers who phoenix their firms to escape fines. The game is rigged. Fuck govt for letting this happen because of who they play golf with!
"I know that people should probably be not giving them this info"
Very easy to say. I have just had a demand from a pension provider to send them copies of my passport and driving license which they are legally required to keep "on file" (i.e. in some unlocked draw) for 5 years or the length of my business with them (i.e. when I die).
I told them to fuck off so they can't provide me with a service.
When the state makes it the law that all of these pissant (and not so pissant) companies demand copies of your nut sack imprint, is it any wonder that every fraudster under the sun has your DNA on file?
Dem gubment.
I've just had a similar demand from a marketing company when I asked for them to provide evidence of consent for a campaign they were involved in.
They demanded:-
Passport
Driver's Licence
Council Tax Bill
Bank Statement
I have refused, so they are refusing to evidence consent. There's absolutely no way that I'm sending that level of detail so they can tell me where I ticked a box to receive spam. I've offered to go round to their head office and allow them to view the documents (but not take copies) - but that is "unacceptable" and they don't meet with "customers".
Off to the regulator with a complaint I go.
@ Derezed, Your pension provider is probably looking over their shoulder at the strict rules on verifying identity to prevent money laundering. That said the application of these rules varies wildly - some are happy to have a utility bill and a bank statement (I suspect difficult enough for many in the El Reg readership who get these electronically). In your case they've applied the rules much more strictly.
@ Uberior
Best of luck with your complaint. In your case with the marketing muppets they definitely have no right to ask for all that stuff and they know it. IANAL but you might like to look up the DPA clause that notes data processors should only collect and process data directly relevant to the matter in hand. Asking for passport and DL is way beyond that level IMO. Unfortunately the ICO tend to be like this too - you have to give them lots of identifying information to make a complaint against the spamming slime.
The problem with Dixons Warehouse is that they've merged so many companies I have no idea if I need to be worried that the details I used to buy a fridge 8 years ago may have been leaked. Although as I'd just moved at the time I doubt I even got the address right...
Which is why I get so irritated with this - companies have no business to be keeping your personal detail for that long without your express consent and knowledge - and not some sneaky weaselwording on the Checkout page like; 'We would like to pass your details on to carefully selected 3rd parties who might interest you. If you would not like for us to not do this, then please don't tick the box.'
'We would like to pass your details on to carefully selected 3rd parties who might interest you. If you would not like for us to not do this, then please don't tick the box.'
It's usually the other way around: you have tick the box for the info NOT to be passed around. And also in some super small font that not's black but close to the background color. One would think that they don't want you to be able to opt out. Some sites have the box already ticked for "receiving" the ads/spam, etc. Depends, on the as you say, weaselwording.
I am sure automatic opt in for marketing was against some regulations at one point. Yes that should count as automatically ticking the opt in box. Maybe GDPR legitimate business interest overrides that :o no fekkin idea to be honest it's all too much for me to comprehend when the cookie box pops up EVERYWHERE.
They have been relentlessly selling data for years anyway.
I tracked down the alleged consent for a spam marketing (for a high APR Credit card) to a company in Bristol who claimed to have been supplied with data from Dixons-Carphone. This was prior to GDPR so Dixons refused to disclose when I "ticked the box" unless I sent them £10...
This isn't so much as 10,000,000 records "stolen", it's more just 10,000,000 records that Dixons aren't getting commission for.
While I am not sure if it was this hack, this month I had my card defrauded, I was told by my card supplier, it was most likely a hack at a retailer I used.
So either its these guys, or keep an eye out for another big leak soon....
What we need is auto-generated card numbers, so we can have a different card number to us to use at different online retailers, surely it wouldn't be that hard to do?
"What we need is auto-generated card numbers, so we can have a different card number to us to use at different online retailers, surely it wouldn't be that hard to do?"
Cahoot tried this many years ago. You could 'create' a card with a specific limit and limited valid date. Worked, but I think the problem is volume of numbers needed.
What is really required is a better authentication scheme. Chip and pin and secure code/verified by visa are better, but as long as people can fall back to simply entering a few non changing values there will be a huge hole that ne'er do wells will exploit.
That's basically how any Android-Pay like scheme works.
My HSBC card got "another number" when entered into Android Pay, which is hidden even from me but used whenever there's a bonk-transaction.
In theory, that code could change at will. But if you're relying on "super secret numbers" rather than "the user knows what's being done" then you have security back-to-front.
Most EU banks text you immediately for every transaction. Except for the UK arms. Who only ever do it - if you're lucky - for transactions over, say, £500 or £1000.
I would have thought that that GDPR thing that arrived last month , and seemed to be a rehashed, re thought, updated set of laws for dealing with data privacy would have included these:
1) An "unsubscribe" link that includes "delete all records of me in your database , including forum comments , product reviews, feedback scores etc etc"
2) An option to "after this purchase delete my financial information"
I guess (1) would have pissed off Facebook and other hoarders too much.
You can do this for all marketing and discretionary data, simply by writing or emailing the data controller of the company concerned, notifying them that you are exercising this right under GDPR.
But bear in mind that for legal reasons, anybody you've had a non-cash financial transaction with has to keep relevant records in compliance with tax and audit requirements, so they are not allowed to delete those. That record retention is (broadly speaking) six years after the end of the relevant annual accounting period and is required by HMRC for tax and VAT purposes, and by the Companies Act for audit and compliance. So your payment details (in some form), your name address, order history won't be deleted on request.
why? by the time i get my money ive already paid tax on it , and the vendor will take vat regardless, my bank are recording where the money went (as are the vendor's bank) , and if using cash circumvents the whole thing anyway whats the point? The only result is dozens of people holding a copy of the key to my bank account!
Given that this is pre-GDPR, the max fine would be £500K. And the cost of doing security properly? My guess is that they count this as a win.
Even Equifax is still trading - a key indicator that there is no justice (yeah, I know that's mostly US). There's no way the authorities are able to say "Sorry, but you're just too crap to be trusted with PII".
From the "probably a stupid idea" file, what if the ICO were able to employ a bunch of suitably gifted people (I nearly said "1337 h4x0rz" there) to actually test whether a company has actually sorted itself out rather than having to take their word for it.
Given that this is pre-GDPR, the max fine would be £500K. And the cost of doing security properly? My guess is that they count this as a win.
I doubt that. The costs to rectify the point of failure, undertaking an ICO compliant investigation, the loss of business from customers choosing to avoid you, costs of marketing to try and repair reputational damage all run into several tens of millions for an instance like this. They might be thinking that they got off with a low fine, but even post GDPR I expect that the costs to the business of a data breach will exceed what they will actually be fined.
The problem is, the board of Dixons Carphone probably believed beforehand that they had a good, strong risk management framework, and that the IT was secure. Anybody that dealt with the board told them it was all hunky-dory, nobody on the board actually had much interest in ITSec. I'm not sure how we change that, but the lack of success in tackling either high level organised crime or low level nuisance like littering suggests that fines and imprisonment don't really act as a deterrent, and won't motivate boards to approach ITSec with any real skill or vigour.
Somewhere up the chain of command between the people who understand the tech and the board, some person will have been keen to "control costs" and be seen to be taking an interest in the bottom line.
You're right about fines not being a deterrent. Hence my musings about whether ultimately the authorities should be able to shut an organisation down if it's repeated shown to be crap with people's data.
Hence my musings about whether ultimately the authorities should be able to shut an organisation down if it's repeated shown to be crap with people's data.
I like the concept, but if enforced equitably, long before any (significant) private sector business were shut down, the ICO would have shut down entire wings of the NHS, a range of local councils and police forces, and central government and civil service itself.
I do have one thought about putting shareholders of these companies on the line too as surely that would give a financial incentive for them to sort it out since bonuses appear to be linked to share prices going ever upwards these days, if a company has too many of these data breaches and the share holders have money taken away from them because of this on a upwards scale I'm sure the money would be flowing out faster than shit on a shovel after the first breach and may actually make companies think about security as an investment rather than a cost.
just a thought admittedly not a fully formed one yet
In today's statement CEO Alex Baldock, who only started in April, said: "We're disappointed in having fallen short here, and very sorry for any distress we've caused our customers. I want to assure them that we remain fully committed to making their personal data safe with us."
Blah blah blah, same kind of statement different day.
"We continue to make improvements and investments at pace to our security environment through enhanced controls, monitoring and testing."
At pace? Makes me think of people running around patching systems that were forgotten.
I hope you are fully testing things before deploying them at pace.
"I want to assure them that we remain fully committed to making their personal data safe with us."
Look here, el Reg. I'm fed up with you just rolling this sort of statement out like that.
Will you please ask their PR people why, if they meant that, they allowed it to happen and tell them you won't publish their boilerplate at all unless they provide an answer to that question to publish alongside it.
They shouldn't be allowed to get away with that crap. The only reason they do is that the media allow them to get away with it. Being allowed to get away with it just encourages them more to the point where Pester thought he could whitewash a major meltdown with some anodyne guff.
Good point, the correct reporting should be along the lines of 'We asked for a response and they used the same rubbish as last time'.
You get one chance to use that excuse and when the second breach hits you go into the 'Can't be trusted with personal data (or looking after the tea kitty)' category until you can prove you have really fixed it with independent testers.
" Being allowed to get away with it just encourages them more to the point where Pester thought he could whitewash a major meltdown with some anodyne guff."
To be fair, he's still in a job, so clearly has got away with it. And the stats I saw in the last week, TSB have gained more customers than they lost since the meltdown, suggesting that most people only tend to have short-term outrage :-|
1) Trip big companys (ideally one with a pretty shit reputation to start with) data breach alert system.
2) Wait for said big company to self-report, and hit the headlines
3a) Flood the interwebs with your carefully crafted phishing emails that look like they are the sort of thing said big company would send out.
and/or
3b) Also hit the phones for some old school phishing.
4) clean up.
Notice how no data was lost - or needed - in the making of this scam.
Of course, this would have nothing to do with their absolutely antiquated IT systems would it? Their store tills run on Windows XP, oh and they have complete internet access on them as well through Chrome and IE.
Those same tills have access to every single customer who has ever purchased from Carphone Warehouse.
I dont think companies should be allowed to hold full credit card data.
If they couldn't they would have to invent some simple app that requests you credit card for monthly purcheses that takes a one click response on a phone to send, for example, the back 8 numbers off the card.
If you used it, this app would have your own cc numbers in your phone to support it. Each hack would result in one half of a cc number exposed instead of ten million full ones.
Big companies, and them charities that take regular payments from granny, would not like it. But consumers would be happy to be asked politely before money is taken off them.
I don't think companies should be allowed to hold full credit card data.
They aren't supposed to, if they want to be PCI-DSS compliant. But lots still do it, and even store them unencrypted as well.
There are well established methods to make repeat payments using an authorisation token, which don't require the retailer to store the card details, and for one off payments the details shouldn't be stored at all.
Companies can store the PAN (16 digit number) and remain PCIDSS compliant, so long as it's properly protected and they comply to all the other requirements that jump in when storage of the PAN is chosen. They cannot store the sensitive data such as mag stripe data & CV2.
But I would agree, there cannot be many situations left where anybody would absolutely need to keep the full PAN itself. Most if not all PSPs nowadays will provide a tokenisation option, and so any storage should be of the token, for any company that might need to carry out repeat payments etc.
They will have had mine at some point as I purchased a fridge from them and got it delivered - so they needed my address for delivery
However, after it was delivered there's no need to keep those details live - they could be archived off at month end (if there are actually any legal reasons to keep it, which I doubt as signed a bit of paper saying delivery was OK so no need for data in digital form)
Once archived it should be deleted from "live".
Obviously archived data should not be easily accessible and ought to be structured in how stored, not one monolithic datasource!
..But we all know they smell cash from personal details (e.g. trying to flog overpriced insurance a while after purchase etc.) so keep the data (insecurely) when there is no real need other than potential monetization.
Well, they have to keep most of the data as a legal requirement (see post further up). You make a very important point though, that they don't have to keep any of that live, other the current financial year.
But why bother, when its only customer data?
Instead of just Downplayed... 'We thought it was 10m records, good news its only 1m'. No, cook the numbers until the story falls off the front page. Then tell the whole ugly truth. Does GDPR cover severity or number of revisions etc? And as for 'No evidence of fraud'? Would you please f$%k 'off. Past similar cases prove it can be years before the damage incubates:
... as the number of infosec 'how not to do it' instances leading to the inevitable car crash is instructive.
A number of people mention the data retention, as though Carphone had been deliberatly keeping the information longer than necessary; the truth in a way was worse, they didn't realise they were retaining it after an external consultant running a test migration stored it all on an insecure web server db. It was there for years, fogotten about before the breach began.
Earlier on today I had cause to access a streaming music service(**) that I hadn't used for a while. As part of the process I had to re-validate my account, and to do so, they asked me for the answer to a secret question (which I'd never set up). Fortunately there was a link on the same page to set the answers to my 3 secret questions. LOL what a fail. Anyway, there is no way I am going to give them my mum's maiden name (which is a real stupid question as my sister knows the answer to that, and the name of my first school, and the name of my first F*** ....) WTF WTF WTF. But even if I could chose the questions, what if these muppets got hacked? Then everyone would know my questions and answers.
It wouldn't let me in unless I provided some answers to some obvious questions. In the end I gave up and gave the answers 1Banana! (*), 2Banana!, 3Banana! It seemed happy enough with these. From now and I reckon that I will use the same answers for all my non-essesial web sites.
(*) I never realised my mum's maiden name was 1Banana!
(**) optical melodies
(***) Don't ask, but it wasn't my sister
06/04/2018 I ordered a GoPro from Curry's PC World on their website. I made absolutely sure I ticked (or unticked) all boxes to ensure I had opted out of all collection of my data for marketing purposes.
13/04/2018 I get an email from CurrysPCWorldFeedback@maruedr.com asking me for feedback on my shopping experience.
13/04/2018 Sent an email to Curry's PC World DPO explaining that I was unhappy with them sharing my data with a marketing outfit.
16/04/2018 I get an email from Revoo asking me to review my GoPro that I purchased on a specified date from Currys PC World.
16/04/2018 I contact both Maruedr and Curry's PC World continuing to express my displeasure at them being incredibly free and easy with my data and apparently ignoring any email I've sent reporting their own organised breach.
20/04/2018 I get a response from Currys PC World DPO telling me they didn't share my data and that I'd received a phishing email.
20/04/2018 I get another duplicate Revoo email.
24/04/2018 Received an email from Currys explaining that they do share my data with third parties for the purpose of conducting surveys, etc.
30/04/2018 I finally get an email from Maruedr (which, it turns out, is a legit if scummy marketing company) confirming that they received my details from Currys PC World (and they list them as a customer on their own website) and have deleted my data and have notified Curry's to do same and tell me to continuing any further correspondence through Currys.
14/05/2018 Receive an email from Maruedr that they have finished deleting my data.
This is still outstanding with Currys PC World and they haven't addressed my concerns, nor confirmed deletion of non-essential data, nor that they won't share it any more. About to report this to the ICO.
This is how much they care about your privacy.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
